EUVD-2026-67398
GHSA-r4gc-q6fw-m869
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Optimole ≤4.2.10 active
-
DeliverySend unauthenticated REST API request with XSS payload in 'a' parameter
-
ExploitPayload persisted to WordPress database without sanitization
-
ExecutionVictim (ideally administrator) navigates to injected page
-
PersistMalicious script executes in victim's browser session
-
ImpactHijack admin cookies or issue privileged API calls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Optimole plugin must be installed and active on a WordPress site running version 4.2.10 or earlier. No attacker account or authentication is required to inject the payload - the vulnerable REST API endpoint accepts the 'a' (above_fold_images) parameter from unauthenticated requests. WordPress REST API access must be reachable over the network, which is the default configuration. After injection, a victim user must visit a page containing the stored payload for script execution to occur; impact scales with the victim's privilege level - exploitation against an administrator yields site-level compromise, while exploitation against a subscriber yields limited user-context impact. No non-default configuration is required to reach the vulnerable parameter. |
| Impact | The CVSS 7.2 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a network-accessible, unauthenticated, low-complexity flaw with changed scope. The UI:N rating is arguably generous for stored XSS since a victim must actively visit the injected page - the CVSS attribution may reflect that no attacker-side interaction is required post-injection, but the exploit chain is not fully automated. Real-world risk is meaningful because Optimole has a notable WordPress install base, and because stored XSS payloads can target administrators, enabling privilege escalation to full site compromise. No CISA KEV listing and no POC are confirmed, which moderates urgency for organizations that cannot patch immediately. The S:C scope change accurately captures that the injected script executes in a different security context (the victim's authenticated browser session) than where the payload is stored. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site's Optimole REST API endpoint, embedding a JavaScript payload in the 'above_fold_images' parameter value. The payload is persisted to the WordPress database without sanitization. When a site administrator subsequently visits a page processed by Optimole, the stored script executes in their privileged browser session, enabling the attacker to exfiltrate the admin's authentication cookies or issue wp-admin API calls to create a backdoor account. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.
RemediationAI
Vendor-released patch: version 4.2.11. Update the Optimole plugin to 4.2.11 or later immediately via the WordPress dashboard (Plugins → Updates) or by downloading directly from the WordPress plugin repository. The specific code-level fix is documented in the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.10&new_path=%2Foptimole-wp/tags/4.2.11. If immediate patching is not possible, a WAF rule blocking script-tag patterns and HTML-encoded variants in the 'a' query parameter on Optimole REST API endpoints can reduce exposure, though this carries a risk of false positives that interfere with plugin functionality. Restricting REST API access to authenticated users only via a WordPress filter (rest_authentication_errors) is a stronger compensating control but will break the unauthenticated image-optimization feature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Optimole is a WordPress image optimization plugin that exposes REST API endpoints for configuring image handling behaviors, including above-the-fold image processing. The vulnerability spans multiple source files: rest.php (lines 935 and 159), manager.php (line 468), and v2/PageProfiler/Profile.php (lines 485 and 189) across versions up to 4.2.10. In these files, the 'a' parameter value is accepted without adequate server-side sanitization and subsequently rendered into page output without proper HTML entity escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) captures this root cause: attacker-controlled input flows from a REST API parameter into persistent storage and then into the HTML DOM without breaking the script execution context, crossing trust boundaries from unauthenticated input to authenticated browser sessions.
Know when Optimole gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS still requires a victim to visit the injected page (UI:R); all other metrics align with the vendor vector - unauthenticated network access, changed scope, low C/I impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Optimole - Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
Optimole image optimization plugin for WordPress (versions through 4.2.10) contains a stored cross-site scripting vulnerability affecting all user browsers. Unauthenticated attackers can inject malicious JavaScript that persists across page views, enabling session hijacking, credential theft, and potential administrative account takeover. No public exploit identified at time of analysis, though the vulnerability affects all WordPress sites using affected versions and requires immediate remediation.
Vendor-released patch: 4.2.11.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting in the Optimole WordPress plugin versions 4.2.3 through 4.2.11 allows unauthenticated attack
Stored cross-site scripting in the Optimole WordPress plugin (versions 4.0.0 through 4.2.12) allows an authenticated use
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service
Unauthenticated stored XSS in Optimole WordPress plugin (≤4.2.2) allows attackers to inject malicious scripts via the sr
Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.7.5. Rated
Stored/reflected Cross-Site Scripting in the Optimole WordPress image-optimization plugin (versions 4.2.7 and earlier) l
Exposure of restricted data in Optimole 4.2.14 and earlier lets authenticated WordPress Subscriber-level users read info
Reflected Cross-Site Scripting (XSS) in Optimole - Optimize Images in Real Time WordPress plugin versions up to 4.2.3 al
Cross-Site Request Forgery in the Optimole WordPress plugin (all versions through 4.2.6) allows unauthenticated remote a
Exploit-DB